780
Proceeds to append an exclamation mark (thelemmy.club)
submitted 4 days ago by to c/lemmyshitpost@lemmy.world
85 comments fedilink hide all child comments
 
you are viewing a single comment's thread
view the rest of the comments
[–] 4 points 3 days ago* (last edited 3 days ago) (4 children)

I'd rather not make the client do anything like that, you cannot trust a client, EVER; what if some script kiddie tries to send the clear passwd by modifyng the request? Ofc it's a very minor problem but still...

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] [S] 3 points 3 days ago (3 children)

    You already trust the client with your password regardless.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 2 points 3 days ago* (2 children)

    I wouldn't send the salt to the client. Have it hash the password, then the server hashes that with the salt for comparison and storage.
    But that would mean you can't verify the password complexity server side, which can be bad for certain accounts.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] [S] 1 point 3 days ago (1 child)

    If there would be an advantage to doing so, the server could still do that anyway. You'd just end up storing client salt and server salt.
    My main concern was MITM which doesn't modify the webpage if web UI is used, such as on corporate networks which require client devices to have that network's root certificate for scanning and activity logging.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •